Declarative insecure self-signed certificates in NixOS

[TLATER]

@waltmck

have devices in my network which I do not entirely trust (i.e. VPS servers with public-facing services and IoT devices), and if one of these were compromised then waltmck-cakey.pem would be readable.

That’s the point; sops uses device-specific encryption, it would only be readable on devices that should be able to read it - or none, I suppose, if you really wanted to store a dev-only secret.

@waltmck

This would actually still be acceptable if it could be done programmatically (i.e. I write a derivation for a root cert given a list of hostnames), but that would require the root certificate generation be reproducible

If you manage your secrets as data and not configuration this is quite a bit less problematic. I would really suggest looking into a flow using sops and a simple script you call anytime you want a new host, rather than using derivations for things that should never be derivations.